docker.yaml

name: DockerImage

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
      - "v[0-9]+.[0-9]+.[0-9]+-*"

env:
  IMAGE_NAME: ghcr.io/${{ github.repository }}

jobs:
  docker-build:
    name: docker-${{ matrix.image.name }} (${{ matrix.platform.value }})
    runs-on: ${{ matrix.platform.runner }}
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        image:
          - name: latest
            dockerfile: Dockerfile
          - name: dev
            dockerfile: Dockerfile.dev
          - name: alpine
            dockerfile: Dockerfile.alpine
        platform:
          - value: linux/amd64
            runner: ubuntu-latest
            digest_suffix: linux-amd64
            qemu: false
          - value: linux/arm64
            runner: ubuntu-24.04-arm
            digest_suffix: linux-arm64
            qemu: false
          - value: linux/arm/v7
            runner: ubuntu-24.04-arm
            digest_suffix: linux-arm-v7
            qemu: true
    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Extract version from tag
        id: get_version
        run: |
          # Remove 'v' prefix from tag
          VERSION=${GITHUB_REF#refs/tags/v}
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          # Detect prerelease (version contains '-')
          if [[ "$VERSION" == *-* ]]; then
            echo "IS_PRERELEASE=true" >> $GITHUB_ENV
          else
            echo "IS_PRERELEASE=false" >> $GITHUB_ENV
          fi

      - name: Set up QEMU
        if: ${{ matrix.platform.qemu }}
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
        with:
          platforms: arm

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
        with:
          platforms: ${{ matrix.platform.value }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.DAGU_GITHUB_TOKEN }}

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
          file: ${{ matrix.image.dockerfile }}
          platforms: ${{ matrix.platform.value }}
          outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
          build-args: |
            LDFLAGS=-X 'main.version=${{ env.VERSION }}'

      - name: Export digest
        run: |
          set -euo pipefail
          mkdir -p "${RUNNER_TEMP}/digests/${{ matrix.image.name }}"
          digest="${{ steps.build.outputs.digest }}"
          if [ -z "$digest" ]; then
            echo "::error::Build digest output is empty"
            exit 1
          fi
          touch "${RUNNER_TEMP}/digests/${{ matrix.image.name }}/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: digests-${{ matrix.image.name }}-${{ matrix.platform.digest_suffix }}
          path: ${{ runner.temp }}/digests/${{ matrix.image.name }}/*
          if-no-files-found: error
          retention-days: 1

  docker-manifest:
    name: docker-${{ matrix.image.name }} manifest
    needs: docker-build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        image:
          - name: latest
            tag_suffix: ""
            channel_tag: latest
          - name: dev
            tag_suffix: "-dev"
            channel_tag: dev
          - name: alpine
            tag_suffix: "-alpine"
            channel_tag: alpine
    steps:
      - name: Extract version from tag
        run: |
          # Remove 'v' prefix from tag
          VERSION=${GITHUB_REF#refs/tags/v}
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          # Detect prerelease (version contains '-')
          if [[ "$VERSION" == *-* ]]; then
            echo "IS_PRERELEASE=true" >> $GITHUB_ENV
          else
            echo "IS_PRERELEASE=false" >> $GITHUB_ENV
          fi

      - name: Download digests
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: digests-${{ matrix.image.name }}-*
          path: ${{ runner.temp }}/digests
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.DAGU_GITHUB_TOKEN }}

      - name: Create manifest
        run: |
          set -euo pipefail

          tags=(-t "${IMAGE_NAME}:${VERSION}${{ matrix.image.tag_suffix }}")
          if [[ "$IS_PRERELEASE" == "false" ]]; then
            tags+=(-t "${IMAGE_NAME}:${{ matrix.image.channel_tag }}")
          fi

          images=()
          while IFS= read -r digest_file; do
            digest="$(basename "$digest_file")"
            images+=("${IMAGE_NAME}@sha256:${digest}")
          done < <(find "${RUNNER_TEMP}/digests" -type f | sort)

          if [ "${#images[@]}" -eq 0 ]; then
            echo "::error::No digests found for ${{ matrix.image.name }}"
            exit 1
          fi

          docker buildx imagetools create "${tags[@]}" "${images[@]}"